Add AL-focused AppSource validation guidance

[Stefano Demiliani (demiliani)]

Summary

• add seven community AppSource knowledge articles with paired good and bad AL samples
• cover company-open subscriptions, profile objects, invariant date literals, page action placement, web-service UI calls, searchable entry points, and time-zone offsets
• update the AppSource review skill to route concrete AL signals to the new guidance
• keep the rules focused on AL source and avoid duplicating privacy, style, security, and upgrade domain ownership

Validation

• pwsh ./.github/scripts/Test-KnowledgeIndex.ps1 -Root . (279 articles)
• pwsh ./tools/Test-ReviewFixtures.ps1 -Root . (32 cases across 16 leaf domains)
• git diff --check
• editor diagnostics

[Natalie Karolak, MVP (NKarolak)]

Please mind the rebranding half a year (or longer) ago: "AppSource extension" --> "Marketplace extension".

[Stefano Demiliani (demiliani)]

Please mind the rebranding half a year (or longer) ago: "AppSource extension" --> "Marketplace extension".

I know (thinked on that yesterday), but then the name should be changed on all the Microsoft's folder rules too. However I don't think this is a need for AI ;)

[Jesper Schulz-Wedde (JesperSchulz)]

Most of these rules map cleanly to the Marketplace technical-validation checklist, but three correctness issues remain.

1. Message is described as a callback failure, but it has different runtime behavior. keep-web-service-paths-free-of-ui-calls.md says calls “including Message” can terminate the service request. Microsoft’s web-service/background-session behavior documents Message as suppressed and logged; Confirm, StrMenu, modal pages, uploads/downloads, etc. are the callback-failure cases. Marketplace validation can still reject message boxes, and a message is ineffective as a service response, but the article and reviewer cue should give that reason rather than teach agents that Message throws NavNCLCallbackNotAllowedException.

2. The company-open bad fixture does not model the forbidden subscription correctly. do-not-subscribe-to-company-open-events.bad.al targets Codeunit::"System Initialization", but that codeunit publishes OnAfterLogin, not OnAfterCompanyOpen. Use a valid OnBeforeCompanyOpen/OnAfterCompanyOpen subscription shape for the BC versions this rule covers (historically the company-open/ApplicationManagement publisher), so the anti-pattern is compilable and AS0061-relevant rather than failing because the event does not exist on the named object.

3. The web-service bad fixture contains two unrelated localization defects. Its hard-coded Confirm and Message format strings trigger the style rule for Label-backed user text, as the specialized review confirmed. Use Qst/Msg Labels so the sample isolates only the web-service UI defect and does not teach a second bad pattern.

Please also adopt the reviewer’s terminology feedback in the seven new articles: say Marketplace extension/app in prose. Keep AppSourceCop, the appsource domain/path, and skill identifiers unchanged because those are product/tool and repository contract names; this does not require a repo-wide rename.

The profile-object, invariant-date, company-open prohibition, action-placement, UsageCategory intent guard, and time-zone guidance otherwise look sound. All repository validators pass.